Almost Everything You Ever Wanted To Know About Security

Almost Everything You Ever Wanted To Know About Security*

*(but were afraid to ask!)

This document is meant to answer some of the questions which regularly

appear in the Usenet newsgroups "comp.security.misc" and "alt.security",

and is meant to provide some background to the subject for newcomers to

that newsgroup.

This FAQ is maintained by Alec Muffett (aem@aber.ac.uk, uknet!aber!aem),

with contributions from numerous others [perhaps]. The views expressed

in the document are the personal views of the author(s), and it should

not be inferred that they are necessarily shared by anyone with whom the

author(s) are now, or ever may be, associated.

Many thanks go to (in no particular order): Steve Bellovin, Matt Bishop,

Mark Brader, Ed DeHart, Dave Hayes, Jeffrey Hutzelman, William LeFebvre,

Wes Morgan, Rob Quinn, Chip Rosenthal, Wietse Venema, Gene Spafford,

John Wack and Randall Atkinson.

Disclaimer: Every attempt is made to ensure that the information

contained in this FAQ is up to date and accurate, but no responsibility

will be accepted for actions resulting from information gained herein.

Questions which this document addresses:

Q.1 What are alt.security and comp.security.misc for?

Q.2 Whats the difference between a hacker and a cracker?

Q.3 What is "security through obscurity"

Q.4 What makes a system insecure?

Q.5 What tools are there to aid security?

Q.6 Isn't it dangerous to give cracking tools to everyone?

Q.7 Where can I get these tools?

Q.8 Why and how do systems get broken into?

Q.9 Who can I contact if I get broken into?

Q.10 What is a firewall?

Q.11 Why shouldn't I use setuid shell scripts?

Q.12 Why shouldn't I leave "root" permanently logged on the console?

Q.13 Why shouldn't I create Unix accounts with null passwords?

Q.14 What security holes are associated with X-windows (and other WMs)?

Q.15 What security holes are associated with NFS?

Q.16 How can I generate safe passwords?

Q.17 Why are passwords so important?

Q.18 How many possible passwords are there?

Q.19 Where can I get more information?

Q.20 How silly can people get?

Read more.............

COMPUTER MAINTENANCE(MUST READ)

Read on to learn what you can do to help improve your computer's security.

Start Here>>>>>>>>

Here are some basics maintenance tasks you can do today to start improving your computer's security. Be sure you make these part of your ongoing maintenance as well.

> Sign up for software update e-mail notices. Many software companies will send you e-mail whenever a software update is available. This is particularly important for your operating system, your antivirus program, and your firewall.
> Register your software. If you still have registration forms for existing software, send them in. And be sure to register new software in the future. This is another way for the software manufacturer to alert you when new updates are available.
> Install software updates immediately.
When you get an update notice, download the update immediately and install it. (Remember, downloading and installing are two separate tasks.)
An ounce of prevention

A few simple steps will help you keep your files safe and clean.

> Step 1: Update your software
> Step 2: Backup your files
> Step 3: Use antivirus software and keep it updated
> Step 4: Change your passwords


Developing ongoing maintenance practices

Now that you've done some ground work, it's time to start moving into longer term maintenance tasks. These are all tasks that you should do today (or as soon as possible) to get started. But for best results, make these a part of a regular maintenance schedule. I recommend setting aside time each week to help keep your computer secure.

> Back up your files. Backing up your files simply means creating a copy of your computer files that you can use in the event the originals are lost. (Accidents can happen.) To learn more read our tips for backing up information.


> Scan your files with up to date antivirus software. Use your antivirus scan tool regularly to search for potential computer viruses and worms. Also, check your antivirus program's user manual to see if you can schedule an automatic scan of your computer. To learn more, read our tips for reducing your virus risk.

> Change your passwords. Using the same password increases the odds that someone else will discover it. Change all of your passwords regularly (we recommend monthly) to reduce your risk. Also, choose your passwords carefully. To learn more, read our tips for creating stronger passwords.

Making a schedule

One of the best ways to help protect your computer is to perform maintenance regularly. To help you keep track, I suggest making a regular "appointment" with your computer. Treat it like you would any other appointment. Record it in your datebook or online calendar, and if you cannot make it, reschedule. Remember, you are not only helping to improve your computer, you are also helping to protect your personal information.

HAVE A NICE DAY AHEAD ..